Argo Workflows (Argo Server, SSO RBAC delegation gatekeeper): With SSO_DELEGATE_RBAC_TO_NAMESPACE enabled, an SSO user

Impact

With SSO_DELEGATE_RBAC_TO_NAMESPACE enabled, an SSO user whose claims match a namespace RBAC rule but no SSO-namespace rule triggers a nil dereference and panics the request path. Low impact on its own, but it is a login-time crash, so the users it affects cannot reach the workflow UI or API at all.

Who can reach it

An authenticated SSO user whose group or claim mapping exists in a tenant namespace but not in the SSO namespace. Requires the operator to have turned on RBAC delegation.

What to do

Upgrade Argo Server to 4.0.5 and restart. As an interim measure either disable SSO_DELEGATE_RBAC_TO_NAMESPACE or ensure every delegated namespace rule has a matching rule in the SSO namespace.

References

Related entries

• BuildKit: unbounded /etc/passwd read from a build image OOM-kills the buildkitd daemonCVE-2026-61712 · BuildKit buildkitd (user resolution in executor/oci/user.go)Low
• Kubernetes (kube-apiserver): TOCTOU/DNS-rebinding bypass of the link-local and localhost proxy protectionsCVE-2020-8562 · Kubernetes (kube-apiserver)Low
• BuildKit: Crafted low-level API message deletes the contents of the host /tmpCVE-2026-15791 · BuildKitLow
• Argo Workflows (controller, expression template evaluation of input parameters): When EXPRESSION_TEMPLATES is on andCVE-2021-37914 · Argo Workflows (controller, expression template evaluation of input parameters)Unscored
• Apache CloudStack CKS: cross-tenant manipulation of Kubernetes clusters when adding or removing nodesCVE-2026-62440 · Apache CloudStack Kubernetes Service (CKS) plugin - node add/remove pathUnscored
• Argo Workflows (Argo Server, TLS keys baked into the container image): Argo Server's TLS private keys ship inside theNCVD-2021-013-argo-workflows-argo-server-tls-k · Argo Workflows (Argo Server, TLS keys baked into the container image)Unscored